e7da97194a
Some checks failed
App Prod-Parity E2E Dispatch / dispatch (push) Failing after 10s
CD Storybook UI / build (push) Failing after 3m25s
CD Storybook UI / dispatch (push) Has been skipped
CD deploy main / website-changed-files (push) Successful in 18m8s
CI Agent Skills / changed-files-check (push) Successful in 18m9s
CI Create App E2E minimal / changed-files-check (push) Successful in 24s
CI Create App / changed-files-check (push) Successful in 26s
CI Docs / changed-files-check (push) Successful in 26s
CI Emails / changed-files-check (push) Successful in 28s
CI Example App Hello World / changed-files-check (push) Successful in 23s
CI Front / changed-files-check (push) Has been skipped
CI Example App Postcard / changed-files-check (push) Successful in 27s
CI UI / changed-files-check (push) Has been skipped
CI Utils Test / changed-files-check (push) Successful in 45s
CI Twenty Apps / discover (push) Successful in 1m3s
CD deploy main / deploy-main (push) Failing after 3s
CI Agent Skills / agent-skills-validate (push) Has been skipped
CI Create App / create-app-test (lint) (push) Has been skipped
CI Emails / emails-test (push) Has been skipped
CI Front / front-task (lingui:compile) (push) Has been skipped
CI Front / front-task (lint) (push) Has been skipped
CI Example App Postcard / example-app-postcard (push) Has been skipped
CI UI / ui-task (lint) (push) Has been skipped
CI UI / ui-task (pack-size) (push) Has been skipped
CI UI / ui-task (size) (push) Has been skipped
CI UI / ui-task (test) (push) Has been skipped
CI UI / ui-task (typecheck) (push) Has been skipped
CI Utils Test / utils-test (push) Has been skipped
CI Twenty Apps / ${{ matrix.app.name }} (push) Has been skipped
CI Emails / ci-emails-status-check (push) Successful in 2s
CI Example App Hello World / ci-example-app-hello-world-status-check (push) Successful in 2s
CI Example App Postcard / ci-example-app-postcard-status-check (push) Successful in 3s
CI UI / ui-sb-test (push) Has been skipped
CI Utils Test / ci-utils-test-status-check (push) Successful in 2s
CI Twenty Apps / ci-twenty-apps-status-check (push) Successful in 2s
CI UI / ci-ui-status-check (push) Successful in 2s
CI Desktop / desktop (push) Failing after 1m8s
Push docs to Crowdin / Push documentation to Crowdin (push) Failing after 55s
Push translations to Crowdin / Extract and upload translations (push) Failing after 5s
Push website translations to Crowdin / Extract and upload website translations (push) Failing after 5s
CI Create App / create-app-test (test) (push) Has been skipped
CI Create App / create-app-test (typecheck) (push) Has been skipped
CI Docs / docs-lint (push) Has been skipped
CI Example App Hello World / example-app-hello-world (push) Has been skipped
CI Front / front-task (lingui:extract) (push) Has been skipped
CI Front / front-task (test) (push) Has been skipped
CI Front / front-task (typecheck) (push) Has been skipped
CI UI / ui-sb-build (push) Failing after 1m32s
CI Twenty Apps / ${{ matrix.app.name }} (${{ matrix.server-source }}) (push) Has been skipped
CI Agent Skills / agent-skills-publish (push) Has been skipped
CI Create App / ci-create-app-status-check (push) Successful in 2s
CI Agent Skills / agent-skills-remote-source (push) Has been skipped
CI Create App E2E minimal / create-app-e2e-minimal (push) Has been cancelled
CI E2E Main / e2e-test (push) Has been cancelled
CI Front / front-sb-build (push) Has been cancelled
CI Front / front-build (push) Has been cancelled
CI Create App E2E minimal / ci-create-app-e2e-minimal-status-check (push) Has been cancelled
CI E2E Main / ci-e2e-main-status-check (push) Has been cancelled
CI E2E Main / notify-main-ci-failure (push) Has been cancelled
CI E2E Main / qa-scout-comment (push) Has been cancelled
CI Front / front-sb-test (push) Has been cancelled
CI Front / front-sb-screenshots (push) Has been cancelled
CI Front / ci-front-status-check (push) Has been cancelled
DPA Sub-Processor Sync / sync-subprocessors (push) Failing after 3s
AI Catalog Sync / sync-catalog (push) Failing after 3s
126 lines
3.2 KiB
Plaintext
126 lines
3.2 KiB
Plaintext
---
|
||
title: SSO 配置
|
||
description: 配置单点登录（SSO），以实现安全的企业级身份验证。
|
||
---
|
||
|
||
## 关于 SSO
|
||
|
||
单点登录（SSO）允许您的团队成员使用您组织的身份提供商登录 Twenty。 这将提供：
|
||
|
||
* **集中式访问控制**：在一个位置管理访问
|
||
* **增强的安全性**：利用您现有的安全策略
|
||
* **更佳的用户体验**：一组凭据适用于所有工具
|
||
|
||
## 支持的提供商
|
||
|
||
Twenty 支持以下 SSO：
|
||
|
||
* **SAML 2.0**：适用于大多数企业身份提供商
|
||
* **Google Workspace**：适用于使用 Google 的组织
|
||
* **Microsoft Entra ID** (原Azure AD)：对于Microsoft 环境
|
||
|
||
## 设置 SSO
|
||
|
||
### 先决条件
|
||
|
||
* 组织计划（云端和自托管工作区）
|
||
* 对您的身份提供商的管理员访问权限
|
||
* 管理员访问您的20个工作区
|
||
|
||
### 配置步骤
|
||
|
||
#### 1. 访问 SSO 设置
|
||
|
||
1. 转到 **设置 → 安全**
|
||
2. 找到 **SSO 配置** 部分
|
||
3. 点击 **配置 SSO**
|
||
|
||
#### 2) 选择服务提供商
|
||
|
||
从列表中选择您的身份提供商，或为其他提供商选择“Custom SAML”。
|
||
|
||
#### 3. 配置您的身份提供商
|
||
|
||
您需要为身份提供商配置以下内容：
|
||
|
||
* **实体 ID**：由 Twenty 提供
|
||
* **ACS URL**：用于身份验证的回调 URL
|
||
* **证书**：用于安全通信
|
||
|
||
#### 4. 在 Twenty 中输入提供商详细信息
|
||
|
||
* **SSO URL**：来自您的提供商的登录 URL
|
||
* **实体 ID**：您的提供商的标识符
|
||
* **证书**：来自您的提供商的 X.509 证书
|
||
|
||
#### 5. 测试并启用
|
||
|
||
1. 点击 **测试配置** 以验证设置
|
||
2. 测试成功后启用 SSO
|
||
3. 配置用户预配偏好设置
|
||
|
||
## 用户预配
|
||
|
||
### 即时（JIT）预配
|
||
|
||
* 用户在首次登录时自动创建
|
||
* 用户被自动分配为默认角色
|
||
* 无需手动创建用户
|
||
|
||
### 手动预配
|
||
|
||
* 在登录前邀请用户
|
||
* 预先分配特定角色
|
||
* 更多控制谁可以访问工作区
|
||
|
||
## 管理 SSO 用户
|
||
|
||
### 角色分配
|
||
|
||
与普通用户一样，可以为 SSO 用户分配角色：
|
||
|
||
1. 转到 **设置 → 成员**
|
||
2. 找到该用户
|
||
3. 根据需要更改其角色
|
||
|
||
### 撤销访问权限
|
||
|
||
要移除 SSO 用户的访问权限：
|
||
|
||
* 将其从您的身份提供商中移除，或
|
||
* 将其从 Twenty 工作区中移除
|
||
|
||
## 最佳实践
|
||
|
||
### 安全
|
||
|
||
* **要求使用 SSO**：为 SSO 用户禁用密码登录
|
||
* **定期审计**：定期审查访问权限
|
||
* **严格的 IdP 策略**：在身份提供商处强制执行 MFA
|
||
|
||
### 用户管理
|
||
|
||
* **清晰的命名**：使用与您的目录一致的命名
|
||
* **组映射**：将 IdP 的组映射到 Twenty 角色（如可用）
|
||
* **离职流程**：将 Twenty 纳入您的停用工作流
|
||
|
||
## 故障排除
|
||
|
||
### 常见问题
|
||
|
||
* **证书错误**: 确保证书未过期
|
||
* **URL 不匹配**：验证CASURL 是否匹配
|
||
* **未找到用户**：检查 JIT 预配设置
|
||
|
||
### 获取帮助
|
||
|
||
如果您遇到问题，请联系支持并提供：
|
||
|
||
* 收到的错误消息
|
||
* 所使用的身份提供商
|
||
* 配置详情（不含敏感数据）
|
||
|
||
<Tip>
|
||
需要为您的组织配置 SSO 吗？ [寻找经过认证的 Twenty 合作伙伴](https://twenty.com/partners/list?categories=SOLUTIONING\&ref=docs-sso)，专注于 SSO 和身份配置。 \*（更希望直接让 Twenty 参与？ [contact@twenty.com](mailto:contact@twenty.com)＊
|
||
</Tip>
|